Canonical Discloses 44 Vulnerabilities in Ubuntu's Rust-Based Coreutils Implementation

In April 2026, Canonical disclosed 44 distinct vulnerabilities (CVEs) in uutils, the Rust-based reimplementation of GNU coreutils that has shipped by default in Ubuntu since version 25.10. These security flaws were uncovered during an external audit commissioned specifically for the upcoming 26.04 Long Term Support release. The findings highlight a critical lesson for systems developers: while the rewrite successfully eliminated memory-safety bugs such as arbitrary memory reads common in legacy C codebases, it introduced a new class of risks at the boundary between the Rust runtime and the Unix filesystem.

The disclosed issues primarily stem from Time-Of-Check-To-Time-Of-Use (TOCTOU) race conditions involving filesystem paths and incorrect handling of raw bytes versus UTF-8 strings. Notably, none of the 44 bugs were detected by Rust's standard safety mechanisms, including the borrow checker, Clippy lints, or Cargo Audit. Specific examples include a local root code execution vulnerability in the chroot utility and a bug where the kill -1 command affected all visible processes instead of a specific process ID.

Due to these security concerns, Canonical has made the decision to retain GNU-based versions of the cp, mv, and rm commands in Ubuntu 26.04 LTS rather than using the Rust implementation. The audit revealed that deviations from GNU coreutils semantics caused significant security issues. For instance, the chmod -R command was found to return the exit code of the last file processed rather than the worst failure, and the kill -1 bug allowed a typo to act as a system-wide kill switch.

The technical root of many vulnerabilities lies in the ergonomic APIs of Rust's standard library, which often take a path and re-resolve it on every syscall. This approach is prone to TOCTOU attacks where an attacker with write access to a parent directory can swap path components for symbolic links between two syscalls. The audit notes that privileged actions landed on attacker-chosen targets because the Rust standard library does not anchor operations on file descriptors in the same way secure C code often does.

Incorrect UTF-8 handling also contributed to denial-of-service conditions in tools like comm and sort. The uutils version replaced non-UTF-8 filenames with replacement characters or panicked, whereas GNU coreutils treats filenames as raw bytes. This divergence meant that nightly cron jobs relying on non-UTF-8 filenames could fail entirely, and the sort --files0-from flag could abort the whole process on the first non-UTF-8 path.

While the audit found no memory-safety bugs, the concentration of these filesystem and logic errors underscores the challenges of reimplementing battle-tested tools. Canonical's announcement serves as a concentrated look at where Rust's safety guarantees end, particularly when bridging the gap between the controlled Rust environment and the messy, chaotic outside world of Unix system calls.